Input validation error in cURL - CVE-2016-8625
Published: August 1, 2018 / Updated: August 3, 2020
Vulnerability identifier: #VU33014
CSH Severity: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2016-8625
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
cURL
cURL
Software vendor:
curl.haxx.se
curl.haxx.se
Description
The vulnerability allows a remote non-authenticated attacker to manipulate data.
curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host.
Remediation
Install update from vendor's website.
External links
- http://www.securityfocus.com/bid/94107
- http://www.securitytracker.com/id/1037192
- https://access.redhat.com/errata/RHSA-2018:2486
- https://access.redhat.com/errata/RHSA-2018:3558
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8625
- https://curl.haxx.se/CVE-2016-8625.patch
- https://curl.haxx.se/docs/adv_20161102K.html
- https://security.gentoo.org/glsa/201701-47
- https://www.tenable.com/security/tns-2016-21